Feeds

eBay pulls Vista laptop pwned in hacking contest

Do no harm

Choosing a cloud hosting partner with confidence

An eBay listing for the Windows Vista laptop that was successfully compromised at last week's Pwn2Own hacking contest was removed after the online auctioneer said it violated terms that forbid sales of items that might do harm.

Shane Macaulay, who felled the machine with code that attacked a weakness in Adobe Flash, posted the listing late Monday night, California time. Within two hours, he said in an interview, he received an automated email that said the auction had been suspended.

According to this article by IDG News, the listing read: "This laptop is a good case study for any forensics group/company/individual that wants to prove how cool they are, and a live example, not canned of what a typical incident response sitchiation [sic] would look like."

"At least on the eBay item, I was being a little sensationalistic, but I was just trying to get a sale," he told El Reg. He said he didn't mean to break contest rules that forbid the disclosure of the flaw or exploit code prior to there being a patch.

"By the time they would have gotten it (the laptop), I'm positively sure it would be patched," he said. "The reason i didn't say that outright (was) i wanted to ... see what the market would pay for" the unpatched vulnerability.

Macaulay was one of two attendees to take a prize during last week's contest at the CanSecWest conference in Vancouver. Charlie Miller and two two other researchers from Independent Security Evaluators, won $10,000 for a previously unknown Safari browser exploit that brought down a fully patched MacBook Pro. Macaulay, who was aided by researcher Alex Sotirov, won $5,000 for their exploit. Winners were also permitted to keep the machines. A third laptop running Ubuntu remained standing.

The cash prize is paid by 3Com's Tipping Point division, whose Zero Day Initiative pays bounties to researchers who responsibly disclose vulnerabilities. One condition imposed on sellers is that they provide no details of the vulnerability.

A spokeswoman for eBay told IDG the wording of Macaulay's listing led them to think the laptop could do someone harm. ®

Intelligent flash storage arrays

More from The Register

next story
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Why did it take antivirus giants YEARS to drill into super-scary Regin? Symantec responds...
FYI this isn't just going to target Windows, Linux and OS X fans
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
Home Office: Fancy flogging us some SECRET SPY GEAR?
If you do, tell NOBODY what it's for or how it works
Astro-boffins start opening universe simulation data
Got a supercomputer? Want to simulate a universe? Here you go
prev story

Whitepapers

Free virtual appliance for wire data analytics
The ExtraHop Discovery Edition is a free virtual appliance will help you to discover the performance of your applications across the network, web, VDI, database, and storage tiers.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
5 critical considerations for enterprise cloud backup
Key considerations when evaluating cloud backup solutions to ensure adequate protection security and availability of enterprise data.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.